A founder with a treasury software product had three proposals on his desk: an Innovation Licence, a "DIFC fintech licence" and a VARA licence. Same business, three answers. The right one depends on what the business does with other people's money, not on which badge sounds best.
A founder who arrived in May had three proposals on his desk. One was for a DIFC Innovation Licence. One was for what it called a "DIFC fintech licence". The third was for a VARA licence. Same business, three answers.
He builds treasury software. Banks run it on their own infrastructure and their own money moves through it. His company never holds a dirham that belongs to anyone else. He needed the first proposal, and only the first. The other two would have cost him a year and a compliance team he had no use for.
I still get asked this most weeks, so here is how we work through it.
The three names are not three versions of the same thing
The DIFC Innovation Licence is a commercial licence. It is issued through the DIFC Registrar of Companies, not the DFSA, and it authorises nothing financial. DIFC describes it as subsidised and advertises it for new registrants only. It comes with access to Innovation Hub coworking desks, and DIFC currently indicates up to four visas on the first desk; confirm the current allocation with DIFC before you plan headcount around it. AI businesses have their own variant, covered in our guide to setting up an AI business in Dubai, and the Innovation Hub has also offered an Innovation Holding Structure for holding shares in technology businesses. The Prescribed Company rules behind that holding route have been amended, so confirm against the current Registrar guidance before relying on it.
A DFSA licence is a financial services authorisation. If your activity is a Financial Service under the DFSA Rulebook, you need it to operate in or from the DIFC, and no commercial licence substitutes for it. Holding client money, payment services, dealing, arranging and advising all sit inside that perimeter. The Innovation Testing Licence is the DFSA's sandbox: a restricted version of that authorisation, typically for twelve months, for a product that is innovative and ready to live-test with customers.
VARA is a different regulator in a different place. Dubai's Virtual Assets Regulatory Authority was created under Law No. 4 of 2022 and covers virtual asset activity across Dubai mainland and the Dubai free zones. The DIFC is excluded. If you are inside the DIFC, VARA is not your regulator; the DFSA and its crypto token regime are.
Two more names belong in the picture even though founders rarely search for them. ADGM's FSRA runs Abu Dhabi's virtual asset framework and finalised its rules on staking in April 2026. And the federal regulator has changed: under Federal Decree-Law No. 32 of 2025, in force from 1 January 2026, the Securities and Commodities Authority became the Capital Market Authority. The companion capital markets law, Federal Decree-Law No. 33 of 2025, says it applies to any person targeting clients in the UAE, even from a financial free zone. If your customers are onshore, that is not a footnote.
Three clients, three answers
The SaaS company selling to banks
A Zurich team with a reconciliation product and two banks piloting it in Europe. Procurement at the Dubai banks wants a local entity. They never take custody, never instruct payments, never advise anyone.
Innovation Licence. The DFSA's position is simple: if your activities are not a regulated financial service, you do not need a DFSA licence to operate in or from the DIFC. The useful work is drafting the activity description so it reads as software, not payments.
The payments app that holds customer money
A founder with a wallet product for gig workers. Users load funds, the app holds them and pays out on request, and the roadmap includes a card. The product is already live in one market.
This is a Financial Service. The choice is between a conventional DFSA application and the Innovation Testing Licence, and the eligibility criteria in GEN Chapter 13 largely decide that for you. The ITL is for something genuinely new that is ready to test. The DFSA says plainly that a business already fully operational, with compliance infrastructure in place, should consider the conventional application instead. Either way, expect the regulator to look at whether you can meet the minimum capital for the activity, whether management has two to three years in the specific business model, and who your compliance officer and money laundering reporting officer actually are. An Innovation Licence here would be a false economy.
The token issuer
A team issuing a utility token with a public sale, a treasury and plans for secondary trading, aimed at users in the UAE and abroad.
Three questions come before any jurisdiction. First, what is the token? The DFSA distinguishes Crypto Tokens from Excluded Tokens such as utility tokens and NFTs, and a token that functions as a medium of exchange, payment or investment will not stay "utility" because the white paper calls it that. Second, what are you doing with it? Issuance, operating a trading venue and custody are separate activities under both the DFSA and VARA frameworks, and VARA's issuance rules treat some issuances as licensable and others as exempt subject to conditions; confirm against the current VARA rulebook. Third, where are the customers? Onshore retail users bring the federal regime into view. And since 12 January 2026, any DFSA firm dealing with the token must run its own documented suitability assessment, because the DFSA no longer publishes a list of recognised tokens.
Most token issuers we meet end up looking at VARA or the FSRA rather than the DIFC, because the DIFC regime is built around authorised firms providing services in tokens. That is an observation, not a rule.
Five routes side by side
| Route | Regulator | What it lets you do | What it does not | Typical fit |
|---|---|---|---|---|
| DIFC Innovation Licence | DIFC Registrar of Companies | Incorporate and trade as a technology business from the DIFC, take Innovation Hub space, sponsor visas, hold IP | Any regulated Financial Service: no client money, payments, dealing or advising | Software, SaaS, data, AI and infrastructure providers selling to regulated firms |
| DFSA Innovation Testing Licence | DFSA | Live-test an innovative Financial Service with customers for a limited period, with limits on clients and transaction values | Operate at scale, or continue past the testing period without an exit application | Fintech with a new product ready to test, not yet fully operational |
| DFSA full authorisation | DFSA | Conduct the Financial Services on your licence in or from the DIFC, including crypto token services under the January 2026 rules | Activity outside your permissions; onshore targeting without looking at the federal position | Payments, custody, investment platforms, asset managers, institutional crypto desks |
| VARA licence | Virtual Assets Regulatory Authority | Licensed virtual asset activities from Dubai mainland or a Dubai free zone | Operate from inside the DIFC; anything that is not a virtual asset activity | Exchanges, brokers, custodians and issuers based in Dubai outside the DIFC |
| ADGM FSRA | Financial Services Regulatory Authority | Financial services and virtual asset activities from Abu Dhabi, including staking under the 2026 framework | Operate from Dubai | Institutional digital asset firms, custodians, funds |
The row you want is the one that describes what your business does with other people's money. Not the one that looks best on a pitch deck.
When you are being upsold
Someone is upselling you if they propose DFSA authorisation for a business that builds tools other people use to conduct financial services. A risk engine, a KYC platform, a core banking module, an AI model that scores credit for a licensed lender: none of these is a Financial Service in itself. If it is genuinely borderline, the DFSA takes enquiries on which regime applies. That is a conversation, not a licence.
The same goes for a VARA licence proposed to a business whose only crypto exposure is that it accepts a stablecoin for a software subscription, or holds part of its own treasury in tokens. Check the current VARA position on your facts, but neither is what the licensing regime is aimed at.
The tell is usually a proposal that leads with the licence and never asks what you do.
When you are underestimating it
The opposite mistake costs more. Founders assume an activity is unregulated because it runs through an app, or because "it is only a beta". Neither is a defence.
Here is a small piece of texture that catches people. The DIFC's own activity list includes Distributed Ledger Technology Services under its fintech and innovation heading, and the description says such firms may not trade in crypto currencies, set up an exchange for them, or provide any financial services, brokerage or payment processing included. We have seen founders pick it for the word "blockchain", then find their product plan was exactly what the wording excludes.
The line I ask people to draw: does any client money, client asset or client instruction pass through your hands or your systems? If yes, you are inside the DFSA, FSRA or VARA perimeter and the only question is which one. Institutional does not mean exempt. When Standard Chartered launched institutional bitcoin and ether spot trading in the UAE on 3 September 2026, it did so through its DFSA-regulated DIFC business, two years after launching digital asset custody there. Custody first, execution second. A start-up doing something similar at smaller scale is not doing something different in kind.
The second underestimate is the federal layer. If you sit in the DIFC and market to UAE residents outside the Centre, take advice on the CMA position before launch rather than after a complaint.
Substance and banking, route by route
An Innovation Licence company needs a real desk, data protection registration, corporate tax registration and annual filings. All manageable. What is not manageable is a bank application with no story. A technology company with no contracts, no invoices and a founder overseas will struggle, and UAE banks ask for evidence of activity before almost anything else. Our corporate banking guide sets out what relationship managers look for.
A DFSA or FSRA firm has a different problem. The regulator expects key individuals, including the senior executive officer, compliance officer and money laundering reporting officer, to be in place and available, office space appropriate to the activity, and capital that meets the rules for your category. In our experience the bank account is not the last step. It runs alongside the application, because the regulator wants to see capital in place and the bank wants to see the regulator's in-principle position before it onboards you. Leave either to the end and the timetable slips by months.
A VARA licensee faces the same shape of problem, plus enhanced due diligence at many banks for anything with "virtual asset" on the licence. Expect detailed questions about wallets and transaction monitoring.
Corporate tax applies across all of them. A DIFC or ADGM entity may be able to claim Qualifying Free Zone Person status on qualifying income, subject to conditions, and whether a software business or a regulated firm meets those conditions depends on what the income actually is. There is no personal income tax on employment or investment income, which is often the founder's real question.
Abu Dhabi deserves a look
The founder in May also had a fourth option nobody quoted him. ADGM's H1 2026 results counted 392 financial services entities, up 27 per cent from 308 a year earlier, and the FSRA's staking framework was finalised in the same half. We compared the two centres in ADGM versus DIFC in 2026, and our ADGM practice handles the Abu Dhabi side directly.
Deciding, then filing
Order matters. Write down, in one paragraph, what the business does with other people's money and assets. Map that paragraph to the regulator whose perimeter it lands in, or to none. Only then choose the licence and the entity.
Atlas advises on that mapping and handles incorporation, registered agent services and ongoing compliance for DIFC company setup on the Innovation Licence and standard commercial routes, working alongside specialist regulatory counsel where a DFSA, FSRA or VARA application is needed. Questions on Qualifying Free Zone Person status go to our tax colleagues at GTAG; Atlas is part of the GTAG/Assetica group. If you have three proposals on your desk and they disagree, send them over and we will tell you which one describes your business.
Frequently Asked Questions
Is the DIFC Innovation Licence a fintech licence?
No. The Innovation Licence is a subsidised commercial licence issued through the DIFC Registrar of Companies for technology and innovation businesses, and it does not authorise any financial service. A fintech that only builds and sells software can use it. A fintech that holds client money, provides payment services, deals in investments or arranges deals needs DFSA authorisation instead, or an Innovation Testing Licence as a first step.
What is the DFSA Innovation Testing Licence?
The ITL is the DFSA's licensed sandbox. It is a restricted financial services licence that lets an eligible firm live-test an innovative product with customers in or from the DIFC, typically for twelve months, with limits on clients and transaction volumes and values. The activity must be one the DFSA regulates, the product must be ready to test, and management must have relevant experience in the specific business model. At the end of the testing period the firm applies to remove the restrictions or withdraws the licence.
Does VARA cover the DIFC?
No. VARA regulates virtual asset activities across Dubai mainland, special development zones and free zones, but the DIFC is excluded and remains under the DFSA. A token business choosing between them is choosing between two regulators with separate rulebooks, so the decision should follow where the activity and the customers actually sit.
What changed for crypto tokens in the DIFC on 12 January 2026?
The DFSA moved from a regulator-led suitability assessment to a firm-led one and stopped publishing a list of Recognised Crypto Tokens. Firms providing financial services involving crypto tokens must now decide, on a reasoned and documented basis, whether each token they engage with meets the DFSA's suitability criteria. Fiat-referenced tokens are treated separately, so confirm the current DFSA guidance for those.
What is the Innovation Holding licence in the DIFC?
The DIFC Innovation Hub has offered an Innovation Holding Structure, set up as a Prescribed Company, for holding shares in businesses anywhere in the world that use, develop or test innovative technology. The Prescribed Company Regulations have since been amended and the qualifying categories have changed. Confirm the current route with the DIFC Registrar before building a holding structure around it.
Do I need a federal licence as well as a DIFC or VARA licence?
Possibly, depending on who you target. From 1 January 2026 the Capital Market Authority replaced the Securities and Commodities Authority, and Federal Decree-Law No. 33 of 2025 states that it applies to any person targeting clients in the UAE, even from a financial free zone. If your customers are onshore UAE residents, take advice on the federal position before you launch.
Which route is fastest for a technology start-up in Dubai?
For a business that does not conduct a regulated financial service, the DIFC Innovation Licence is the lightest route, because it runs through the Registrar without a regulatory authorisation. Any route involving the DFSA, the FSRA or VARA is measured in months rather than weeks, requires a business plan the regulator will test, and needs named individuals in compliance and money laundering reporting roles.